ClawHub
Back to skill

Security audit

payaion-transfer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Payaion file-transfer and marketplace helper, with external upload and paid listing behavior matching its stated purpose.

Install only if you want agents to send selected files or URLs to Payaion. Confirm the exact file, price, payout address, and whether the item should be public before using paid marketplace flows, and avoid sensitive paths unless you explicitly intend to upload them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## One-Shot API (recommended — single request does everything)

Upload + wait for ready + set price + list on marketplace — all in ONE curl call. The server handles polling internally and returns the final result.

### Upload a local file with pricing and marketplace listing
Confidence
97% confidence
Finding
This skill is explicitly designed to transmit local files or URL-fetched content to an external third-party API, which is a real exfiltration surface in an agent environment. Because the instructions encourage one-shot uploads and even marketplace listing, an agent could disclose sensitive data off-host with a single tool invocation if user intent or path validation is weak.

Static analysis

No suspicious patterns detected.